BuiltBehind
ContactCustomer loginReturn to main site →

Security overview

Security claims must follow evidence.

This page sets the required security baseline without claiming certifications or controls that have not yet been independently verified.

Published information · Updated 22 August 2026
Evidence-based assurance

BuiltBehind does not claim ISO 27001, SOC 2, Cyber Essentials or another independent certification unless current evidence and scope are published.

1. Required principles

  • Data minimisation and purpose limitation.
  • Least-privilege access with strong authentication.
  • Encryption in transit and appropriate encryption at rest.
  • Separation between customer workspaces and partner accounts.
  • Auditable administrative and automation activity.
  • Secure secrets, supplier and integration management.

2. Operational controls

  • Asset and data-flow inventory.
  • Role and access review process.
  • Backup, recovery and business-continuity tests.
  • Vulnerability, dependency and configuration management.
  • Logging, monitoring, alerting and failed-workflow handling.
  • Incident response, notification and post-incident review.
  • Supplier due diligence and subprocessor oversight.

3. Reporting concerns

Security concerns should use the verified support route supplied within an active BuiltBehind account. Public product questions can use Contact & support, but do not send vulnerability details through the interactive application experience or public chat.

4. Evidence before claims

Future trust claims should link to current evidence, scope, date and owner. Marketing language must not imply independent assurance where none exists.